Windows: bundled rg.exe found but not executable (Access is denied), local rg.exe works

### What version of Codex is running?
Codex Desktop app (Windows Store package path contains OpenAI.Codex_26.409.7971.0_x64__...)

Which model were you using?

GPT-5.4 (desktop app session)

What platform is your computer?

Windows (PowerShell), workspace in E:\PortableApps\BackupScripts

What issue are you seeing?

Codex resolves rg / rg.exe to the bundled binary inside:

C:\Program Files\WindowsApps\OpenAI.Codex_...\app\resources\rg.exe

But executing it fails with:

Fehler beim Ausführen des Programms "rg.exe": Zugriff verweigert
(= "Access is denied")

So Get-Command rg succeeds, but runtime execution fails.

What steps can reproduce the bug?

1. In a Codex Desktop Windows session, run:

• Get-Command rg

1. Observe it points to the app package path under WindowsApps.
2. Run:

• rg --version
• rg -n "Backup_ToBak.bat" .

1. Both fail with access denied.
2. Copy a standalone rg.exe into the current working directory and run:

• .\rg.exe --version
• .\rg.exe -n "Backup_ToBak.bat" .

1. This works and returns matches.

What is the expected behavior?

If Codex reports rg as available, it should be executable.
Either:

• ship a runnable bundled ripgrep path for Windows sessions, or
• gracefully fall back to another search method when bundled rg.exe is not executable.

What do you see instead?

Bundled path is discoverable but unusable (permission denied), causing tool/search failures unless user manually provides another rg.exe.

Additional information

• findstr works in the same session.
• The issue appears specific to the bundled WindowsApps ripgrep binary execution, not to the workspace or general shell execution.